Browse / Automattic

Automattic

See its reports on the map

Attack surface: 277 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Automattic

• Cross-site Scripting59
• Authentication18
• Information Disclosure12
• Cross-Site Request Forgery10
• Insecure Direct Object Reference9
• Code Execution9

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR able to buy a plan with lesser feeInformativeInsecure Direct Object Reference (IDOR) · medium
   12 votes
2. Invalidate session after password reset on https://polldaddy.comInformativeInsufficient Session Expiration
   12 votes
3. Stored XSS in assets.txmblr.comInformativeCross-site Scripting (XSS) - Stored · medium
   10 votes
4. GET /api/v2/url_info endpoint is vulnerable to Blind SSRFInformativeServer-Side Request Forgery (SSRF) · high
   9 votes
5. Non-changing "_idnonce" value leads to CSRF on accounts at https://intensedebate.com for account takeoverInformativeCross-Site Request Forgery (CSRF) · low
   8 votes
6. Top 10 2013-A2-Broken Authentication and Session Management - wordpress.comInformativeImproper Authentication - Generic
   4 votes
7. HTML form without CSRF protectionInformativeCross-Site Request Forgery (CSRF)
   4 votes
8. Process of changing email address and password does not asks old Password.InformativeImproper Authentication - Generic
   3 votes
9. Missing HSTS header in https://app.simplenote.comInformativeCryptographic Issues - Generic
   2 votes
10. User Enumeration and Guessable User Account Attack on WORDPRESSInformativeInformation Disclosure
    2 votes
11. Serving Transitions From: HTTP Protocol (not secure)InformativeInformation Disclosure
    2 votes
12. Session Cookie without Secure flag setInformativeImproper Authentication - Generic
    2 votes
13. Missing HSTS header in https://public-api.wordpress.comInformativeCryptographic Issues - Generic
    1 votes
14. Session Cookie without Secure flag setInformativeImproper Authentication - Generic
    1 votes